VulnSocial

CVE-2026-57807Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-288

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 4 classified signals
  • General: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-07-13); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-07-13: 2Mentions · 2026-07-21: 1Mentions · 2026-08-08: 1Mentions · 2026-09-06: 1Patch / Workaround · 2026-07-13: 1Patch / Workaround · 2026-07-21: 1Patch / Workaround · 2026-09-06: 1Technical Details · 2026-07-13: 2Technical Details · 2026-07-21: 107-1307-2108-0809-06
Signal classification2 categories
Disclosure
480.0%
General
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-132
Disclosure2
2026-07-211
Disclosure1
2026-08-081
General1
2026-09-061
Disclosure1
Full discourse5 posts
  • Netlas.io@Netlas_io
    Disclosure

    CVE-2026-57807 & CVE-2026-12761: Two vulnerable WordPress plugins by miniOrange, 9.8 rating both 🔥 There are two authentication bypass vulnerabilities disclosed in miniOrange plugins: OAuth Single Sign On - SSO & Social Login and Register (Discord, Google, Twitter, LinkedIn). These flaws might allow a malicious actor to gain admin access to the website. 👉 https://nt.ls/M4c8B

    Post summary

    The tweet announces two authentication bypass vulnerabilities in miniOrange WordPress plugins (OAuth SSO & Social Login, Register) that could allow attackers to gain admin access, but offers no PoC, exploit code, or mitigation details.

    0501121.9K
    7.7K followersView on X
  • System Force I.T.@systemforce
    Disclosure

    A widely-used WordPress plugin that lets website visitors log in using their Google, Microsoft or Facebook account has been found to contain a critical security flaw, and at the time of writing there is no patch available from the vendor. https://systemforce.co.uk/blog/2026/09/06/wordpress-miniorange-sso-cve-2026-57807-disable-now/ https://t.co/eqjBx0MgGV

    Post summary

    A well-known WordPress login plugin is cited as containing a critical flaw, with no vendor patch available at the time of posting.

    00140221
    3.0K followersView on X
  • iototsecnews@iototsecnews
    Disclosure

    WordPress OAuth SSO プラグインの脆弱性 CVE-2026-57807：Web サイト乗っ取りの恐れ https://iototsecnews.jp/2026/07/13/critical-wordpress-plugin-vulnerability-allows-attackers-to-gain-full-control-over-website/ 脆弱性 CVE-2026-57807 は、 OAuth プラグインのパスワード回復メカニズムにおいて認証制御が適切に適用されていないことに起因します。それにより、代替の認証経路が悪用され、管理者アカウントを含む Web サイト全体の制御が、完全にバイパスされる可能性があります。開発者にとって、認証処理の実装時にセキュリティ上の代替パスが発生していないことの検証はきわめて重要です。公式パッチが未公開であるため、対象のプラグインを直ちに無効化もしくは削除し、WAF などでアクセスを制限する対策が推奨されています。ご利用のチームは、ご注意ください。 #CVE202657807 #OAuthSSO #Vulnerability #WordPress

    Post summary

    An advisory reports CVE-2026-57807 in the WordPress OAuth SSO plugin, detailing an authentication bypass flaw that could allow full site takeover, and recommends disabling the plugin or applying WAF workarounds while awaiting an official patch.

    01000232
    500 followersView on X
  • System Force I.T.@systemforce
    General

    If your website runs on WordPress and uses a plugin to let staff sign in with their Microsoft or Google accounts, there is a serious security issue you need to act on today. https://systemforce.co.uk/blog/2026/08/08/miniorange-sso-plugin-cve-2026-57807-wordpress-admin-bypass/ https://t.co/1Q52OVbF1R

    Post summary

    The post alerts that a serious issue (CVE-2026-57807) exists in a WordPress SSO plugin and directs readers to a blog for details, but gives no technical, exploit, or patch information.

    0000070
    3.0K followersView on X
  • protect_cyber_sec@AmirHossein_sec
    Disclosure

    قابل توجه ادمین های Wordpress : برای پلاگین miniOrange OAuth SSO ، آسیب پذیری جدیدی با کد شناسایی CVE-2026-57807 و از نوع authentication bypass منتشر شده است. نسخه های تا ورژن 38.5.8 مربوط به این پلاگین ، دارای این آسیب پذیری می باشند. برای امن سازی پلاگین را به روز رسانی کنید . https://t.co/GXJq8gtjQL

    Post summary

    The tweet announces a new authentication bypass vulnerability (CVE‑2026‑57807) in the miniOrange OAuth SSO WordPress plugin up to version 38.5.8 and recommends admins to update the plugin to mitigate the risk.

    0000063
    205 followersView on X

Explore more

Back to dashboard